For instances where the SA server fails to automatically discover a new host (e.g. RMAd appliance), even after performing the "Remove and Repurpose Host" feature in Administration \ Appliances (SA 10.4.X) or Administration \ Hosts (SA 10.5.X and later) and after KB #000035266 - How to Decommission a Host from the Puppet Trust Model has been performed.
This article provides the manual procedure for adding appliance without using the RSA NetWitness/Security Analytics UI discover feature.
Note: It is often more productive to change the puppet node_id using KB #000034305 -https://community.rsa.com/docs/DOC-61938 and reboot the appliance OS and perform 'service mcollective restart' on SA server to allow Discover to occur.
On the NetWitness Head Unit Server which hosts the puppet MongoDB 1. Display the nodes To display a particular nodes' services: Syntax showing only the _id, node and classes fields: